.github — LCV Ideas & Software

Institutional repository for the organization profile and shared community-health defaults across LCV Ideas & Software repositories.

Status. Active institutional repository. Current release: not versioned — it publishes surfaces rather than a numbered artifact. Notable changes are recorded in CHANGELOG.md.

This repository hosts the organization profile rendered at https://github.com/LCV-Ideas-Software and any community health files (issue templates, code of conduct, contributing guides, etc.) shared as defaults across the organization.

• The org-profile content lives in profile/README.md. GitHub renders it on the organization landing page automatically.
• The static organization site lives in site/ and is published by pages.yml to GitHub Pages at https://org.lcv.dev.
• Since LCV-204 this repository no longer deploys to Cloudflare Pages. The canonical public site https://www.lcv.dev is published from LCV-Ideas-Software/.github-private, which serves the same site/ to the Cloudflare Pages project enterprise-site and to https://enterprise.lcv.dev on GitHub Pages.
• The two copies of site/ must stay byte-identical. Each repository records a SHA-256 manifest of its own copy in site/site-manifest.json, and site-parity.yml compares it daily with the manifest the counterpart publishes.
• The approved Privacy Policy, Terms of Services and Security pages apply to the products and resources that adopt them. Their canonical addresses are https://www.lcv.dev/privacy/, https://www.lcv.dev/tos/ and https://www.lcv.dev/security/. Prior privacy versions remain under site/privacy/<version>/. These pages are served from the counterpart repository; this copy is the one the parity gate holds it to.
• The sponsor landing page lives in site/sponsor/ and renders MercadoPago.js V2 Card Payment Brick secure fields backed by the dedicated sponsor-motor Worker at https://sponsor-motor.lcv.app.br.
• Dependabot checks GitHub Actions and npm every day at 05h (UTC−03:00), including weekends, groups minor and patch version updates and security updates separately per ecosystem, and automatically rebases its pull requests. A cooldown stays configured but every dependency is excluded from it (* inside each package-ecosystem block), so updates are proposed immediately; security updates are never delayed (LCV-596).
• The Pages workflow uses GitHub's official Pages Actions and includes the public-site formatting, npm provenance-signature, and advisory checks in its artifact build. Pages and Site Parity select the repository's Node.js 26 toolchain from .node-version.
• CodeQL runs through GitHub's code scanning default setup, without a workflow file. Dependency Review, Zizmor, and OpenSSF Scorecard invoke their official Actions directly, pinned by full commit SHA. Repository-owned SARIF gates, policy manifests, lockfiles, workflow-contract validators, and scanner wrappers are intentionally absent.
• Linear Release uses Linear's official Action, pinned to the immutable commit of v0.18.2, with CLI v0.18.0 selected explicitly, to mirror every main commit into the continuous .github-org pipeline. This does not introduce a numbered artifact or an organization-wide controller; it records only this repository's own releases. The upstream installer verifies the downloaded CLI against a published SHA-256 checksum before executing it.
• Pull requests reach main only through squash, under the Enterprise rulesets. Dependabot pull requests receive GitHub's native auto-merge from .github/workflows/dependabot-auto-merge.yml, a repository-local workflow that runs no Action and uses a fine-grained personal access token stored as the Dependabot secret DEPENDABOT_AUTOMERGE_TOKEN; GitHub performs the merge only once every rule and check is satisfied. There is no merge queue, GitHub App, or organization-wide controller.
• Per-repository community health files (e.g. CONTRIBUTING.md, SECURITY.md, CODE_OF_CONDUCT.md) defined here apply org-wide unless the individual repository overrides them.

The approved account-deletion form at https://www.lcv.dev/account-deletion/ uses the public HTTPS API base https://privacy-api.lcv.dev, configured in the account-deletion-api meta element of site/account-deletion/index.html. [email protected] remains available. The API implements GET /config, POST /sessions, POST /sessions/confirm, POST /sessions/renew, POST /requests and GET /requests/{identifier}. It owns email verification, HttpOnly session cookies, internal registry annotations and the native Linear protocol. The page sends credentials with requests, removes confirmation parameters from the URL, and passes Firebase App Check both when it requests the confirmation link and when it confirms that link automatically, without storing the pending email or state in browser storage. The confirmed email stays visible and read-only. Each tab keeps its own session context in memory and sends X-Deletion-Context when registering or looking up a request; a cookie from another confirmation cannot authorize the original tab. It contains no analytics or advertising tags. Backend implementation remains in github-operations.

The page requires the account email to be confirmed first, then full name (up to 200 characters), an 11-digit normalized CPF, date of birth in YYYY-MM-DD format and an 11-digit Brazilian mobile WhatsApp number containing only the area code and number, without a country code. It sends fullName, cpf, dateOfBirth and normalized whatsapp in the request JSON; the email remains associated with the confirmed session. A successful response must contain a valid identifier, which the page displays as the protocol. Both source=form and source=email use these four fields. Email invitations keep the original request and protocol, and registration must return that same identifier. An unavailable asynchronous BigDataCorp check does not prevent registration of the protocol. Email-session renewal uses only the original renewal capability and a stable operation identifier through /sessions/renew; it never starts a new form request. Personal fields are cleared only after the service accepts the renewal, while the protocol is preserved. A new Google confirmation link is required to authorize the new page. Before confirmation succeeds, a failed link offers an explicit way to open /account-deletion/ without parameters in a new tab. The original page stays open and retains its confirmation attempt. The new form receives no email, protocol or personal data from that attempt and requires a new Google confirmation. A Central invitation must be renewed through Central to preserve the original email request; opening a separate form does not renew that invitation. Terminal invitation errors keep renewal disabled and direct the requester to Central. Cross-origin API access is allowed only from https://www.lcv.dev. Whenever the page changes, synchronize both copies and regenerate both site manifests.

Organization-wide operational systems, reusable actions, controllers, schedulers, canaries, and private runbooks are intentionally absent from this public institutional repository. Their implementation and operation belong in github-operations. The workflows retained here act only on this repository's own pull requests, public institutional surfaces, and security posture; they are not organization-wide control systems.

Changes from 11/08/2026 onward are recorded in CHANGELOG.md, grouped by date, each linked to the pull request that carried it or, for changes that are repository settings rather than files, to the issue holding their execution trail. Earlier work is not summarized there; the commit history remains its record.

For product-specific documentation, see each repository in the organization listing.

The organization currently has 1 public, 2 internal and 18 private repositories. By the operator decision of 11/10/2026 (11 October 2026), only .github is public; .github-private and github-operations are internal, and all other organization repositories are private. All GitHub Pages sites remain public. The operator-service source repositories admin-app, sponsor-motor and mtasts-motor are private. The public profile and shared site identify that visibility without linking visitors to source they cannot access. Deployed service access and existing license terms remain governed separately.

Repository conventions

• License: proprietary — All rights reserved. Public visibility exists for GitHub's special .github features and grants no rights beyond those provided by the applicable GitHub Terms of Service through the platform.
• Notices: see NOTICE and THIRDPARTY.
• Security disclosure: see SECURITY.md.
• Code of conduct: see CODE_OF_CONDUCT.md.
• Contributing: see CONTRIBUTING.md.
• Inbound rights for this repository: see INBOUND.md.
• Support: see SUPPORT.md.
• Sponsorship: see this repository's Sponsor button or central sponsor page.
• Action pinning: all external GitHub Actions are pinned by full commit SHA per supply-chain hardening baseline.
• Code owners: .github/CODEOWNERS.

Links

• Site: https://www.lcv.dev
• GitHub organization: LCV-Ideas-Software
• Repository: .github
• Sponsors: https://github.com/sponsors/lcv-ideas-software

License

Copyright © 2026 LCV Ideas & Software. The original content of this repository owned by LCV Ideas & Software is proprietary and all rights are reserved. Third-party and contributor-owned material remains subject to its own documented terms. Public visibility permits viewing and forking through GitHub as provided by the applicable GitHub Terms of Service; it does not grant an additional public license. See the GitHub Terms of Service, LICENSE, NOTICE, and THIRDPARTY.

---

Copyright © 2026 LCV Ideas & Software
_{LEONARDO CARDOZO VARGAS TECNOLOGIA DA INFORMACAO LTDA
Rua Pais Leme, 215 Conj 1713 - Pinheiros
São Paulo - SP - CEP 05424-150
CNPJ: 66.584.678/0001-77 - IM: 3039854 - Número D‑U‑N‑S® 583149431}

Entire

See Entire setup, merge gates and verification evidence.